Domain 5: Governance, Risk, and Compliance (14%)

Question 1

5.3 Personnel

Least Privilege

Answer 1

Users are only given the lowest level of access needed to perform their
job functions

§ Does everyone in the company need to know employee salary data?

Question 2

5.3 Personnel

Separation of duties

Answer 2

Requires more than one person to conduct a sensitive task or operation

§ Separation of duties can be implemented by a single user with a user and
admin account

Question 3

5.3 Personnel

Job rotation

Answer 3

Occurs when users are cycled through various jobs to learn the overall
operations better, reduce their boredom, enhance their skill level, and
most importantly, increase our security
§ Job rotation helps the employee become more well-rounded and learn
new skills
§ Job rotation also helps the organization identify theft, fraud, and abuse of
position

Question 4

5.4 Risk management Strategies

risk avoidance

Answer 4

A strategy that requires stopping the activity that has risk or
choosing a less risky alternative

Question 5

5.4 Risk management Strategies

Risk Transfer

Answer 5

A strategy that passes the risk to a third party

Question 6

5.4 Risk management Strategies

Risk Mitigation

Answer 6

A strategy that seeks to minimize the risk to an acceptable level

Question 7

5.4 Risk management Strategies

Risk Acceptance

Answer 7

A strategy that seeks to accept the current level of risk and the
costs associated with it if the risk were realized

Question 8

5.4 Risk Analysis

Residual Risk

Answer 8

The risk remaining after trying to avoid, transfer, or mitigate the
risk

Question 9

5.4 Risk Analysis

Qualitative risk assessment type

Answer 9

Qualitative analysis uses intuition, experience, and other methods to assign a
relative value to risk
o Experience is critical in qualitative analysis

Question 10

5.4 Risk Analysis

Quantitative Risk assessment type

Answer 10

Quantitative analysis uses numerical and monetary values to calculate risk
o Quantitative analysis can calculate a direct cost for each risk
o Magnitude of Impact

ALE (annual Loss Expectancy) = SLE (single loss expectancy = AV x EF) x ARO (Annual Rate of Occurence)

Question 11

Users are only given the lowest level of access needed to perform their
job functions

§ Does everyone in the company need to know employee salary data?

Answer 11

5.3 Personnel

Least Privilege

Question 12

Requires more than one person to conduct a sensitive task or operation

§ Separation of duties can be implemented by a single user with a user and
admin account

Answer 12

5.3 Personnel

Separation of duties

Question 13

Occurs when users are cycled through various jobs to learn the overall
operations better, reduce their boredom, enhance their skill level, and
most importantly, increase our security
§ Job rotation helps the employee become more well-rounded and learn
new skills
§ Job rotation also helps the organization identify theft, fraud, and abuse of
position

Answer 13

5.3 Personnel

Job rotation

Question 14

A strategy that requires stopping the activity that has risk or
choosing a less risky alternative

Answer 14

5.4 Risk management Strategies

risk avoidance

Question 15

A strategy that passes the risk to a third party

Answer 15

5.4 Risk management Strategies

Risk Transfer

Question 16

A strategy that seeks to minimize the risk to an acceptable level

Answer 16

5.4 Risk management Strategies

Risk Mitigation

Question 17

A strategy that seeks to accept the current level of risk and the
costs associated with it if the risk were realized

Answer 17

5.4 Risk management Strategies

Risk Acceptance

Question 18

The risk remaining after trying to avoid, transfer, or mitigate the
risk

Answer 18

5.4 Risk Analysis

Residual Risk

Question 19

Qualitative analysis uses intuition, experience, and other methods to assign a
relative value to risk
o Experience is critical in qualitative analysis

Answer 19

5.4 Risk Analysis

Qualitative risk assessment type

Question 20

Quantitative analysis uses numerical and monetary values to calculate risk
o Quantitative analysis can calculate a direct cost for each risk
o Magnitude of Impact

ALE (annual Loss Expectancy) = SLE (single loss expectancy = AV x EF) x ARO (Annual Rate of Occurence)

Answer 20

5.4 Risk Analysis

Quantitative Risk assessment type

Question 21

The individual elements, objects, or parts of a system that would cause
the whole system to fail if they were to fail

Answer 21

5.4 Business impact analysis

Single point of failure

Question 22

Personal data cannot be collected processed or retained without the
individual’s informed consent

§ also provides the right for a user to withdraw consent, to inspect,
amend, or erase data held about them

§ requires data breach notification within 72 hours

Answer 22

5.2 Regulations, Standards, and legislation

General Data Protection Regulation (GDPR)

Question 23

Defines the rules that restrict how a computer, network, or other systems
may be used

Answer 23

5.3 Personnel

Acceptable use policy

Question 24

Defines the structured way of changing the state of a computer system,
network, or IT procedure

Answer 24

5.3 Organizational Polices

Change management

Question 25

Different users are trained to perform the tasks of the same position to
help prevent and identify fraud that could occur if only one employee
had the job

Answer 25

5.3 Personnel

Job Rotation

Question 26

Dictates what type of things need to be done when an employee is hired,
fired, or quits
§ Terminated employees are often not cooperative

Answer 26

5.3 Personnel

onboarding and offboarding

Question 27

Agreement between two parties that defines what data is considered
confidential and cannot be shared outside of the relationship

§are a binding contract

Answer 27

5.3 Third-party risk management

Non-Disclosure Agreement (NDA)

Question 28

A non-binding agreement between two or more organizations to detail
an intended common line of action

can be between multiple organizations

Answer 28

5.3 Third-party risk management

Memorandum of understanding(MOU)

Question 29

An agreement concerned with the ability to support and respond to
problems within a given timeframe and continuing to provide the agreed
upon level of service to the user

§may promise 99.999% uptime

Answer 29

5.3 Third-party risk management

Service-level Agreement(SLA)

Question 30

Conducted between two business partners that establishes the
conditions of their relationship

§ can also include security requirements

Answer 30

5.3 Third-party risk management

Business Partnership Agreement(BPA)